UNITED STATES OF AMERICA 



v. 



STIPULATION OF 
EXPECTED TESTIMONY 



Manning, Bradley E. 

PFC, U.S. Army, 

HHC, U.S. Army Garrison, 

Joint Base Myer-Henderson Hall 



DATED: 



SA Troy M. Bettencourt 



June 2013 



Fort Myer, Virginia 22211 ) 

It is hereby agreed by the Accused, Defense Counsel, and Trial Counsel, that if S A Troy 
M. Bettencourt were present to testify during the merits and pre-sentencing phases of this court- 
martial, he would testify substantially as follows: 

1 . I am a Special Agent (S A) for the Special Inspector General for the Troubled Asset Relief 
Program (SIGTARP), U.S. Department of the Treasury. Specifically, I work for the Computer 
Forensics Unit (CFU), SIGTARP. My current job title is Senior Special Agent (SSA) and I am 
located in Washington, DC. As an SSA for the CFU, my job primarily entails providing digital 
forensic and e-Discovery support to SIGTARP's nationwide criminal investigations. I also 
conduct criminal investigations of crimes within SIGTARP's investigative purview. I have 
served as a Special Agent for SIGTARP for approximately 1 and a half years. 

2. From November 2010 to December 201 1, 1 was a Special Agent for the U.S. Army Criminal 
Investigation Command (CID). Specifically, I worked for the Computer Crimes Investigation 
Unit (CCIU). I was assigned to the Washington Metro Resident Agency, CCIU, and investigated 
crimes within CCIU's investigative purview, with a focus on the PFC Manning investigation. 

3. From June 2007 to November 2010, 1 was an administrator with the Punta Gorda Police 
Department where I was responsible for accreditation, staff inspections/audits, 
administrative/management studies, personnel supervision, media relations, and forensic 
imaging/preliminary analysis of digital evidence in cases ranging from prostitution to homicide. 

4. From May 2005 to June 2007, 1 owned and operated my own business. From October 2001 
to May 2005, 1 was a Special Agent with CCIU. I supervised a team of special agents 
responsible for investigating crimes within CCIU's investigative purview. I was also assigned as 
the CID liaison to the U.S. Army Computer Emergency Response Team (ACERT) and the Joint 
Task Force - Global Network Operations (JTF-GNO). 

5. From February 1999 - September 2001, 1 was a Special Agent with the Hawaii Field Office, 
CID, where I served as an assistant team chief of a drug suppression team, as well as an 
investigator on a general crimes investigative team and a child abuse/sexual crimes investigative 
team. 

6. I earned a Masters of Public Administration (Criminal Justice Administration) from Troy 
University located in Alabama. I have had extensive training in evidence collection and 
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handling to include, but not limited to, the 1 7-week Apprentice Special Agents Course. In terms 
of computers and forensics training, I have completed multiple courses over the years. I 
completed three courses at the Defense Cyber Investigative Training Academy (DCITA) in 
Linthicum, Maryland, between the years 2001 and 201 1, which covered digital media collection 
issues. From 2002-2003, 1 attended two courses at Guidance Software in Reston, Virginia (the 
manufacturer of EnCase). During this time I also completed four courses at Learning Tree 
International, which focused on information network security. In 2003, 1 completed the Federal 
Law Enforcement Training Center Seized Evidence Recovery Specialist training/certification in 
Glynco, Georgia. In 2009 and 2013, 1 attended two courses conducted by AccessData 
(manufacturer of FTK). In 2012, 1 completed a training/certification course on use of the 
Cellebrite Universal Forensic Extraction Device. These courses all discussed the collection, 
handling, and/or forensic analysis of digital evidence. 

7. I earned a Department of Defense Certified Digital Media Collector certificate in 201 1 from 
the Department of Defense Cyber Crime Center (DC3), which must be renewed every two years. 
I have not renewed it as I no longer work for a Department of Defense entity. I earned the 
Federal Law Enforcement Training Center Seized Evidence Recovery Specialist certification in 
2003, which did not require recertification. I earned the Cellebrite Universal Forensic Extraction 
Device (UFED) Certification in 2012, which does not require recertification. I also earned the 
following certifications which have since lapsed: Learning Tree International Network Security 
Certified Professional (2003); Guidance Software Encase Certified Examiner (2004); 
AccessData Certified Examiner (2009). In addition to my training and certifications, I have 
investigated or supervised more than 1 00 investigations involving computer crime and 
investigated or supervised between 200-300 criminal investigations unrelated to computer crime. 

8. On 30 August 201 1, as part of this investigation, I downloaded the "Cablegate" archive from 
"www. wikileaks.org" based on press reports indicating that all Department of State diplomatic 
cables in the possession of WikiLeaks had been posted on the WikiLeaks website. The archive I 
collected contained 25 1 ,287 purported Department of State diplomatic cables or messages. The 
purported cables ranged in date from 1966 to February 2010. I know this because I personally 
reviewed the "Cablegate" archive after collection. This review of the contents of the archive 
revealed that no information had been redacted from the files. 
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